Review

Business Premium or E3? The Seat Ceiling Every Growing Firm Runs Into

10 min read Updated October 4, 2026 Microsoft Licensing Guides

Fix it now

Microsoft caps the Business family at 300 provisioned licences per tenant, counted across Basic, Standard and Premium together. Enterprise plans have no limit and may run alongside Business plans in the same tenant. Below the cap Business Premium is usually the stronger security bundle; above it, E3 is the baseline and you have an endpoint gap to close.

Stay on Business Premium under 300 seats unless a compliance obligation needs the enterprise Purview tooling.
Start the comparison at around 200 seats. The ceiling is a planning event, not an emergency.
Budget the endpoint gap into any move to E3: Business Premium carries Defender for Business with detection and response, and E3 carries Defender for Endpoint Plan 1, which has neither.
Do not plan a permanent mixed estate for endpoints. Microsoft states Defender for Business does not support mixed licensing and the tenant defaults to the Defender for Business experience for all users.
Move for Windows 11 Enterprise rights and the enterprise compliance tooling, not for features nobody will operate.
Look at the frontline plans for shared-device staff instead of paying full seats for people who need email and a rota.

If you are under 300 seats and nobody is asking for enterprise compliance tooling, stop here: Business Premium is the better bundle. Below is the ceiling stated exactly, and the endpoint detail that reverses expectations.

Why it happens

These two plans are aimed at different sizes of organisation rather than different appetites for features, and the boundary is hard. Microsoft’s plan options guidance states the rule directly: the base per-user Business plans are designed for organisations with up to 300 users, so an organisation provisioned for 250 seats of Business Premium is eligible to provision only 50 more seats in total across the Business family, and Microsoft reserves the right to enforce the tenant limit of 300 provisioned licences across that family. Enterprise plans support an unlimited number of users.

Two things follow. The ceiling counts Basic, Standard and Premium together, so you cannot buy 300 of each. And because enterprise seats in the same tenant do not count towards it – Microsoft explicitly permits combining Enterprise, Business and standalone plans within a single account – the usual transition is a mixed tenant rather than a migration weekend.

The move to E3 quietly reduces your endpoint security

You have this one if You have grown past 300 seats, E3 costs more than Business Premium, and everybody assumes the more expensive plan must be the more secure one.

On endpoints it is not. Business Premium includes Microsoft Defender for Business, which carries endpoint detection and response, automated investigation and remediation, automatic attack disruption, threat analytics, advanced hunting with 30 days of data and core vulnerability management.
E3 includes Microsoft Defender for Endpoint Plan 1, which has next-generation protection, attack surface reduction, device control, web content filtering, manual response actions and centralised management – and none of the detection and response, investigation or hunting capability.
Budget the higher endpoint tier as part of the move, or move to E5, or you will have less visibility at 310 seats than you had at 290.

You are planning to run Defender for Business and Defender for Endpoint side by side

You have this one if A transition plan that keeps the original population on Business Premium and puts new joiners on E3 with Defender for Endpoint, indefinitely.

Microsoft states that Defender for Business does not support mixed licensing within a single organisation. If both subscriptions are present, the organisation defaults to the Defender for Business experience for all users.
To use Defender for Endpoint Plan 2 instead, you must license all users for Plan 2 and contact Microsoft Support to request the switch.
Decide on one endpoint model and move the whole estate. Mixed plan families for productivity are fine; mixed endpoint security is not the same thing.

You are moving early to avoid a rushed migration later

You have this one if Comfortably under 200 seats, but somebody has decided E3 is where the company is heading so it may as well go now.

Moving well before you need to means paying enterprise pricing for capability you are not operating, and losing endpoint features in the process.
A sensible trigger is planning the comparison at around 200 seats and executing it when growth makes the ceiling a foreseeable problem within a year.
E3’s enterprise tooling assumes somebody whose job is to run it. If that person does not exist, the tooling produces cost and no improvement.

Where E3 is genuinely stronger is Windows and compliance. E3 carries Windows 11 Enterprise E3 rather than the Windows entitlement Business Premium lists, and it is the plan that the enterprise deployment and management ecosystem assumes: configuration baselines, hybrid licensing guidance and third-party tooling are all written with the enterprise plans in mind.

Full reference

Where each plan is stronger

Dimension	Microsoft 365 Business Premium	Microsoft 365 E3
Seat ceiling	300 across the Business family, per tenant	None
Office apps and core services	Yes	Yes
Windows edition rights	Windows 11 listed among inclusions	Windows 11 Enterprise E3
Microsoft Entra ID	P1	P1
Microsoft Intune	Plan 1	Plan 1
Endpoint security product	Microsoft Defender for Business	Microsoft Defender for Endpoint Plan 1
Endpoint detection and response	Yes	No
Automated investigation and remediation	Yes	No
Advanced hunting	Yes, 30 days of data	No
Mail threat protection	Microsoft Defender for Office 365 Plan 1	Microsoft Defender for Office 365 Plan 1
Purview compliance tooling	Data Loss Prevention and Information Protection	Purview, extensible with the Microsoft Purview Suite
Shared computer activation	Yes	Yes, through Microsoft 365 Apps for enterprise
Azure Virtual Desktop eligibility	Yes	Yes

Both plans include Microsoft Defender for Office 365 Plan 1. Older comparisons that show mail protection as a separate purchase on E3 are out of date, and pricing a move on that basis overstates the enterprise quote.

The endpoint gap, in detail

This is the single most common problem created by this particular upgrade, so it is worth setting out precisely. Microsoft’s own comparison puts endpoint detection and response, automated investigation and response, automatic attack disruption, core vulnerability management, threat analytics and advanced hunting with 30 days of data in Defender for Business. Defender for Endpoint Plan 1 has none of those six. Plan 2 has all of them, plus six months of advanced hunting retention and Microsoft Threat Experts.

So a company moving from Business Premium to E3 purely because it has grown ends up with weaker endpoint visibility than it had before, unless it buys the higher endpoint tier as an add-on or moves to E5. Price that at the point of transition rather than discovering it during an incident. Note also that Defender for Business is itself designed for organisations of up to 300 users, so the endpoint change is forced by the same growth that forced the plan change.

Servers, which neither plan covers

Neither Business Premium’s Defender for Business nor E3’s Defender for Endpoint Plan 1 covers a server operating system. Under Business Premium you can add the Defender for Business servers add-on, but Microsoft caps that at 60 server licences per customer; above 60 servers you need Microsoft Defender for Endpoint Server or Microsoft Defender for Servers Plan 1 or Plan 2. A growing organisation frequently crosses the server cap and the user cap at different times, so check both.

Planning the transition

At around 200 seats, price E3 and Business Premium side by side including the endpoint add-on that E3 will need.
Decide the endpoint model first, because Microsoft does not support running Defender for Business and Defender for Endpoint in one organisation.
Check the server count against the 60-licence cap on the Defender for Business servers add-on at the same time.
Move the whole estate’s endpoint licensing together, then move productivity plans at whatever pace suits, since Business and Enterprise productivity plans coexist happily in one tenant.
Re-scope conditional access, device compliance and threat policies after the move, because the simplified Defender for Business configuration does not map one-to-one onto the full policy surface.
Review whether frontline staff should be on a frontline plan rather than a full seat.

Which plan to be on, by situation

Under 300 seats with no specialist compliance obligation: Business Premium, and it is not close on value.
Under 300 seats with a regulatory retention or discovery obligation: compare E3 plus the Microsoft Purview Suite, or E5, against what Business Premium provides.
Between 200 and 300 seats and hiring: start the comparison now, before the ceiling sets the timetable.
Past 300 seats: E3 as the baseline, plus the higher endpoint tier so you do not lose detection and response.
Multi-site or multi-country with a real IT function: E3, for the Windows 11 Enterprise rights and the enterprise management alignment.
A workforce with shared-device frontline staff: look at the frontline plans for that group.

When a licence is the actual fix

While you are under the seat ceiling, Microsoft 365 Business Premium is generally the better bundle, and Arco supplies it alongside E3 and E5 so a mixed tenant is straightforward to arrange. If you are approaching 300 seats across the Business family, tell us your current headcount and your hiring plan and we will map out the transition, including the endpoint protection add-on that stops the move to E3 quietly reducing your security, and the 60-server cap on the Defender for Business servers add-on if you are using it. Where the honest answer is that you should stay exactly where you are for another year, we will say so: there is no advantage to moving early and a fair amount of work in doing it twice.

Questions people ask about this

Can I run Business Premium and E3 in the same tenant?

Yes for productivity licensing. Microsoft permits combining Enterprise, Business and standalone plans within a single account, and enterprise seats do not count towards the 300-licence Business family limit. The exception is endpoint security: Microsoft states Defender for Business does not support mixed licensing, and a tenant holding both subscriptions defaults to the Defender for Business experience for all users.

Does moving from Business Premium to E3 lose me anything?

On endpoints, yes, unless you add the higher tier. Business Premium’s Defender for Business includes endpoint detection and response, automated investigation and remediation, attack disruption, threat analytics, advanced hunting with 30 days of data and core vulnerability management. E3’s Defender for Endpoint Plan 1 includes none of those. Mail protection is unchanged: both carry Defender for Office 365 Plan 1.

Is the 300-seat limit per plan or per tenant?

Per tenant, counted across the Business family. Microsoft’s guidance gives the example directly: an organisation provisioned for 250 Business Premium seats may provision only 50 more in total across Business Basic, Business Standard and Business Premium combined. Enterprise seats in the same tenant do not count towards it.

Should we move to E3 early to avoid a rushed migration later?

Only if you are close. Moving early means paying enterprise pricing for capability you are not operating and losing endpoint detection and response in the process. Plan the comparison at around 200 seats and execute it when growth makes the ceiling a foreseeable problem within a year.

What happens to our servers?

Neither plan covers a server operating system. Business Premium customers can add the Defender for Business servers add-on, which Microsoft caps at 60 server licences per customer; above that you need Microsoft Defender for Endpoint Server or Microsoft Defender for Servers Plan 1 or Plan 2. Check the server count at the same time as the user count, because the two ceilings are reached independently.

Was this article helpful?

Your feedback helps us improve our documentation.

Review Counting Cores Correctly: Server Licence Minimums That Catch People Out Review CSP, Open Value or Perpetual: Which Buying Route Suits Your Business? Review SQL Server Web vs Standard: Web Edition Ends at SQL Server 2022 Review Per User or Per Device? Choosing a Microsoft 365 Assignment Model

← Back to Knowledge Base